I am using ADFS 3.0 for SSO on SharePoint 2013, I have followed the instructions at http://info.summit7systems.com/blog/beginners-guide-to-claims-based-authentication-ad-fs-3-0-and-sharepoint-2013-part-ii-installing-and-configuring-ad-fs-3-0
but every time I login using the ADFS login page I receive the below error
No strong authentication method found for the request from urn:sharepoint:ontrack.
at Microsoft.IdentityServer.Web.Authentication.AuthenticationPolicyEvaluator.
this is the configuration of authnetication policies
Enabling ADFS tracing will likely give you further insight. I received this error and it related to not having a custom multifactor authentication provider installed on a particular ADFS node.
Is your SharePoint RPT setup for multifactor authentication? If so, you may ensure that the appropriate MFA provider displays and is enabled on the Multi-factor tab.
Related
I do not see [Application Groups] folder in my ADFS. How can I install it to see it in my AD FS Management?
I want my WEB API(REST) project to connect to ADFS for authentication. Additionally, I want to test my REST API Authentication without a login screen, please help in this as well. My API will be consumed by CRM users, who are already connected to ADFS. Now the requirement is to create an REST API which will be hit by CRM users and CRM user will pass a userid and password which will be authenticated by ADFS internally without login screen. How can I do that?
Any help please.
Thanks
Application Groups are only available in Server 2016 and 2019. They are available in the ADFS wizard by default.
In terms of sample code for calling API, have a look here.
We have identity server V3 used inside my web application. We would like to use same identities to communicate with sharepoint 2016. Any repository or doc available on how to implement single sign on for sharepoint 2016 and Identity server V3 ?
You'd have to research how to get sharepoint to use IdentityServer as its identity provider.
I prototyped SSO in a test SharePoint 2010 environment a few years and used the links below for assistance. Some of the information may be outdated but I think the relationship between the STS (which in this case would be Identity Server V3 - Thinktecture) and SharePoint has not changed.
I am currently setting up SSO with our SharePoint application as well as other applications. I am using Azure Access Control Service (ACS) to act as a repository for all of the Identity Providers we would like to use. The providers are Facebook,Google,Windows Live ID and LinkedIn. ACS allows you to add custom Identity Providers as well. We have a CRM application that we currently authenticate against within our SharePoint application using claims and forms based authentication. This will be a custom identity provider defined in ACS. I am beginning to work with Thinktecture to be the identity provider that will sit on top of our CRM application. Users will then be able to login to SharePoint with any of the identity providers specified in ACS. We will see how it goes but I believe this will work. I would start with the General HowTos to using STS in SharePoint link.
FederationMetaData.xml editing
http://stsmetadataeditor.codeplex.com/documentation
http://social.msdn.microsoft.com/Forums/is/Geneva/thread/c0791595-2e0d-48cb-82f0-8e0f0bc1809a
http://jefferytay.wordpress.com/2012/05/03/windows-identity-foundationupdating-an-expired-issuer-certificate/
Regarding the "The issuer of the token is not a trusted issuer" error message.
search string - sharepoint 2010 The issuer of the token is not a trusted issuer
http://social.msdn.microsoft.com/Forums/en-ZA/sharepoint2010general/thread/f7dbbf1b-f616-4b24-ae0c-e8c76aa300d5
FedUtil.exe Information
http://msdn.microsoft.com/en-us/library/ee517284.aspx
General HowTos to using STS in SharePoint
http://msdn.microsoft.com/en-us/library/ff955607.aspx
I am trying to write an WPF client which uses ADAL to authenticate against ADFS on a Windows Server 2012 R2. I have successfully implemented this using "Forms Authentication" where the user is prompted for the domain username and password. However, I want to take advantage of SSO and use the currently logged on domain user to authenticate against the ADFS.
Unfortunately, I'm only getting an error message saying:
This method overload is not supported by '< ADFS servername>'
I have done a lot of searching, but find some of the information contradictive:
This SO post about a Windows Store App (any differences to WPF?) where Vittorio Bertocci links to a blog on how to achieve it:
ADAL for Windows Store SSO
This SO post where Vittorio Bertocci claims that silent authentication is only possible with Windows Server 2016:
Authenticate with ADFS inside Console App silently
Is it a fact that Windows Server 2016 is required to perform SSO in conjunction with ADAL?
Is there any other way to do it?
EDIT:
After upgrading to the latest alpha of ADAL (3.9.302111717-alpha) I'm getting the more detailed error message
MSIS9611: The authorization server does not support the requested 'grant_type'. The authorization server only supports 'authorization_code' or 'refresh_token' as the grant type.
The code I'm executing is this:
string authority = "https://myServer.com/adfs";
string resourceURI = "http://myApp/";
string clientId = "XXXX-XXX-XXXX-XXXX-XXXXX";
string clientReturnUri = "http://anarbitraryreturnuri/";
var ac = new AuthenticationContext(authority, false);
var token = await ac.AcquireTokenAsync(resourceURI, clientId,new UserCredential());
I was able to implement a working solution using WS-Trust, so I am confident that the machine I'm running on has the privacy settings to enable the app to find the currently logged on user.
The Oauth2 endpoint looks as follows:
Also, my global authentication policy is set up like this:
Windows Server 2016 is only required for the password grant - in which you provide raw username and password. Your question seems to suggest you want to sign on with the currently signed in user, which would leverage Kerberos instead.
Kerberos based authentication should work with ADFS "3" and ADFS 2016 indifferently - as long as your client is connected to the domain network, the local machine does not have privacy settings that prevent your app from finding out the domain user currently logged in and the correct endpoints are enabled on the ADFS instance.
I have an ADFS single sign on application. Can we also have form authentication using login credential from a database on the same application? In other words, I need single-sign-on for people who have windows account and form authentication for people who do not have windows account. I did some research on this topic but I have no lead. Is there any suggestion?
Out of the box ADFS can only authenticate against Active Directory (The latest version of ADFS (vNext) do supports LDAP v3-compliant directories).
You need to build your own Custom Authentication Provider for ADFS if you would like to plugin your custom code.
Some pointers for further reading:
Understanding WIF 4.5
Create a Custom Authentication Provider for Active Directory Federation Services
My knowledge of these systems is not large so please forgive me if I am asking dumb questions.
I hope to achieve the following:
Idp (AD FS 2.0) -> SAML 2.0 -> Sp (simpleSAMLphp)
*I don't need anything more fancy than to simply authenticate a user.
I have attempted to configure Windows Server 2008 with AD FS 2.0 (domain A) as an Identity provider and have it handle authentication requests from a service provider on a different domain (created using simpleSAMLphp (domain B)).
The AD FS 2.0 Management application allows me to add raw meta XML from the SP to configure the idp. And my SP has the facility to do the same. So I figure that If I setup the idp (AD FS 2.0) correctly then I will simple just have to make the SP interpret the metadata of the idp.
Currently I feel that I am close to a solution (but then again I am probably wrong!). Currently it seems everything is find right up to the point when the Idp asks for your login credentials, and I enter my credentials, it appears that the session has started, but I get a 'Not Authorized - HTTP Error 401. The requested resource requires user authentication.' message after entering the correct login credentials.
Could someone please explain how to fix this? or if it's quicker a step by step setup to make AD FS 2.0 authenticate using SAML 2.0 for simply authenticating a username and password.
Thankyou in advance for any hints!
Have you established a claims provider trust within ADFS 2.0 management? Your system needs to accept claims-bearing tokens from a trusted claims provider. That is, whatever STS -- "Security Token Service" -- you have in front of your user repository. ADFS can both a "Relying Party" -- RP -- or a STS. You need both a relying party and a STS.
Check out Eugenio Pace's MSDN blog for more details:
http://blogs.msdn.com/b/eugeniop/archive/tags/federated+identity/